Active Directory Enumeration

What is Active Directory Enumeration?
Active Directory Enumeration is the process of gathering information about an Active Directory (AD) environment, such as users, groups, permissions, domains, and other important configuration details. This step is critical for penetration testing, red teaming, and attacks on Active Directory environments, as it provides attackers with essential insights into the network's structure and vulnerabilities.
Why is AD Enumeration Important?
●    Identify Targets: Discover high-privilege accounts, service accounts, and vulnerable groups.

●    Map the Network: Understand the structure of domains, organizational units (OUs), and trusts.

●    Find Weaknesses: Look for outdated accounts, weak permissions, and misconfigurations.

●    Plan Lateral Movement: Plan how to escalate privileges and move laterally within the network.

________________________________________
Key Elements of Active Directory Enumeration
1.User Accounts: Identify users, including admin, service, and guest accounts.

2.Groups: Discover group memberships, especially privileged groups like Domain Admins, Enterprise Admins, etc.

3.Domain Structure: Enumerate domains, OUs, and trust relationships to understand the layout of the network.

4.Services: Identify service accounts, exposed SMB shares, and RDP-enabled hosts.

5.Permissions: Check for misconfigured permissions or over-permissive access in groups and shares.

6.Replication: Identify potential replication targets to use for further exploitation (e.g., DCSync).

________________________________________

 Tools for Active Directory Enumeration

________________________________________
 Active Directory Enumeration Methods
1. User and Group Enumeration (PowerView)
Get a List of All AD Users

 Get-NetUser
● Returns all users in the domain, including their group memberships.

Find Users in Privileged Groups

 Get-NetGroup -Group "Domain Admins"
● Returns users who are members of privileged groups like Domain Admins or Enterprise Admins.

Enumerate User Properties

 Get-ADUser -Filter * -Properties *
● Gets detailed user properties like lastLogon, passwordLastSet, memberof, etc.

2. Group Enumeration (PowerView)
Enumerate All Groups

 Get-NetGroup
● Lists all groups within the domain.

Find Groups and Their Members

 Get-ADGroupMember "Domain Admins"
● Lists all members of the “Domain Admins” group.

3. Domain and Organizational Unit Enumeration (PowerView)
Enumerate Domains in a Forest

 Get-NetDomain
● Identifies all domains in the Active Directory forest.

Enumerate Organizational Units (OUs)

 Get-NetOU
● Lists all organizational units within the domain.

4. Service Account Enumeration
Search for Service Accounts

 Get-NetUser -UserType Service
● Finds accounts with the "Service" type, often used for running critical services.

5. SMB and Share Enumeration (Nmap)
Scan for SMB Shares

 nmap --script smb-enum-shares.nse
● Scans for and enumerates SMB shares available on a remote host.

________________________________________
Example of Enumeration Using PowerView
List All Users

1. Get-NetUser    
○    This command will output a list of all users, which you can use to identify key accounts or service accounts for further targeting.

Enumerate Groups (e.g., Domain Admins)

2.  Get-NetGroup -Group "Domain Admins"  
○    This will show members of the Domain Admins group, which is critical for high-privilege attacks.

Find Users with Specific Permissions

3.  Get-NetUser -Filter {memberof -eq "Domain Admins"}   
○    This shows all users that are members of the Domain Admins group.

Enumerate Organizational Units (OUs)

 4. Get-NetOU   
○    Reveals the structure of your target Active Directory environment, including all OUs.

________________________________________
Real-World Scenario:
Scenario 1: Compromising an Account via Enumeration
1. Identify Users: You use PowerView to list all users and notice a user in the Domain Admins group.

2. Check User Details: You gather further information on the user (password policy, last login).

3. Find Weaknesses: If you notice weak password policies or unused accounts, you may exploit this to escalate privileges.

Scenario 2: Lateral Movement via SMB Shares
1. Scan SMB Shares: Use Nmap to identify accessible SMB shares on other domain machines.

2. Find Sensitive Shares: Discover a share containing sensitive data or credentials.

3. Access Data: Use this data to escalate privileges or find further attack vectors.

________________________________________
How to Detect & Prevent Active Directory Enumeration
 Detection (Blue Team)

•  Monitor PowerShell activity using Windows Event Logs (Event ID 4104).
•  Detect suspicious network activity and SMB connections using Sysmon and SIEM systems.
•  Look for unusual service accounts that may have excessive privileges or can be exploited.
•  Alert on enumeration of domain objects like groups, users, and OUs.

Here are 15 one-word questions with their corresponding answers and hints based on the content about Active Directory Enumeration: